Critical Severity
CVE-2026-109618
Published: Oct 25, 2026
CVE-2026-109618 / CVE-2026-109619 — unauthenticated RCE in PHP's session.upload_progress handler (CVSS 9.2). Reproducible Docker lab against stock WordPress and Laravel on PHP 8.4.26, plus a read-only on-host audit script.
# php2shell
Exploit lab and read-only on-host audit for **CVE-2026-109618 / CVE-2026-109619**,
two unauthenticated RCEs in the PHP engine itself.
| | |
|---|---|
| `CVE-2026-109618` | RCE via OOM-handling corruption during multipart parsing |
| `CVE-2026-109619` | RCE via stale request-owned global state surviving heap free |
| Severity | CVSS 4.0 **9.2**, pre-auth |
| Advisories | `GHSA-w8hw-w9fx-j79w`, `GHSA-6wmf-4rv5-p3rp` |
> **Authorized use only.** The lab targets are containers bound to
> `127.0.0.1`. The audit script is read-only and sends no exploit traffic.
## Why the audit exists
There is no reliable external scanner for this. You will find vendors claiming
their DAST, WAF or "PHP vulnerability detection" product catches it; for this
bug class that claim does not hold up. The corruption happens in request
parsing, before application code and before any response the application
controls. There is no version banner to fingerprint, no payload reflection to
observe, and no stable error signature to match. A black-box scanner can only
guess.
The only dependable answer comes from inside the host: find the PHP runtime
that *actually serves requests*, and check whether it contains the fix.
```bash
sudo ./audit/audit-host.sh # human-readable report
sudo ./audit/audit-host.sh --json # machine-readable, for aggregation
```
It is read-only: it starts nothing, writes nothing, sends no exploit payload,
never triggers an OOM. Safe on production. Note that `php -v` alone is not
enough: distro backports, panel patches and un-restarted workers all produce a
version number that lies. The script checks the binary, the package changelog,
the live FastCGI worker and `/proc/*/maps`.
Verdicts, coverage and mitigation detail: [audit/README.md](audit/README.md).
## The exploit lab
A working chain against pinned PHP 8.4.26: proof the bugs are real, and a
reproducible target for testing detection and mitigation.
|